Skip to content
Fencer Vulns
medium 6.9

CVE-2024-47764 json

cookie accepts cookie name, path, and domain with out of bounds characters

published 2024-10-04 2 y ago modified 2026-09-10 1 mo ago also GHSA-pxg6-pf52-xh8x , EUVD-2024-3106

cvss
6.9
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 55%
public exploits
0
none known

Summary

cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.

Patch / fix

  • npm cookie 0.7.0
  • node-cookie Debian 14, Debian 13 0.7.1+~0.6.0-1

debian advisories DEBIAN-CVE-2024-47764

  • reaper CBL-Mariner 2.0 3.1.1-13

azure linux advisories AZL-50114

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-47764 updated cvss 3.7

cookie: cookie accepts cookie name, path, and domain with out of bounds characters

  • Red Hat Cryostat 3 cookie Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/logging-view-plugin-rhel9 Red Hat Migration Toolkit for Applications 7 mta/mta-ui-rhel9, mta/mta-cli-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Migration Toolkit for Virtualization migration-toolkit-virtualization/mtv-console-plugin-rhel9 Red Hat Multicluster Engine for Kubernetes multicluster-engine/multicluster-engine-console-mce-rhel9
    +29 more products
    Red Hat OpenShift Lightspeed lightspeed-console-plugin-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-hub-db-migration-rhel8 Red Hat OpenShift Serverless cookie Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel8 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8, advanced-cluster-security/rhacs-roxctl-rhel8, advanced-cluster-security/rhacs-rhel8-operator, advanced-cluster-security/rhacs-central-db-rhel8, advanced-cluster-security/rhacs-scanner-v4-rhel8, advanced-cluster-security/rhacs-scanner-v4-db-rhel8 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, aap-cloud-ui-container, automation-eda-controller, ansible-automation-platform-25/lightspeed-rhel8 Red Hat build of Apache Camel - HawtIO 4 cookie Red Hat build of OptaPlanner 8 cookie Red Hat Data Grid 8 cookie Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh-operator-container Red Hat Discovery 1 discovery-server-container Red Hat JBoss Data Grid 7 cookie Red Hat JBoss Enterprise Application Platform 7 cookie Red Hat JBoss Enterprise Application Platform 8 cookie Red Hat JBoss Enterprise Application Platform Expansion Pack cookie Red Hat OpenShift AI (RHOAI) odh-operator-container, odh-dashboard-container Red Hat OpenShift Container Platform 4 openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel9, openshift4/nmstate-console-plugin-rhel9, openshift4/ose-networking-console-plugin-rhel9 Red Hat Openshift Container Storage 4 ocs4/mcg-core-rhel8 Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel8, odf4/odf-console-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-multicluster-console-rhel8 Red Hat OpenShift Data Science (RHODS) rhods/odh-rhel8-operator, rhods/odh-dashboard-rhel8 Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/traefik-rhel8, devspaces/dashboard-rhel8 Red Hat OpenShift distributed tracing 3 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-query-rhel8, rhosdt/jaeger-ingester-rhel8, rhosdt/jaeger-collector-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-es-rollover-rhel8, +1 more Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argo-rollouts-rhel8, openshift-gitops-1/console-plugin-rhel8, openshift-gitops-argocd-rhel9-container Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9 Red Hat Process Automation 7 cookie Red Hat Quay 3 quay/quay-rhel8 Red Hat Trusted Artifact Signer trillian-redis-rhel9, rekor-search-ui-rhel9, trillian-database-rhel9, trillian-logserver-rhel9, trillian-logsigner-rhel9 Red Hat Trusted Profile Analyzer rhtpa-trustification-service-rhel9
    affected: no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm cookie
<0.7.0
0.7.0

Affected products

  • jshttp cookie

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.